up vote 0 down vote favorite
share [g+] share [fb]

is there a way to separate clients in a subnet so that they cannot reach each other?

The infrastructure currently looks like this:

  • 192.168.0.1/24 Gateway, a CentOS box with iptables.
  • 192.168.0.10-20 Some clients which may reach each other
  • 192.168.0.30 A single client which
    • should not be able to reach the hosts 192.168.0.10-20
    • should be able to reach the gateway and the internet

I don't know if it is possible, maybe you could give me your ideas how it could be done. I cannot influence the machine 192.168.0.30 because it is a virtual machine I want to rent to someone. Thanks.

link|improve this question
feedback

1 Answer

up vote 1 down vote

The rule you need in your FORWARD chain is:

iptables <insert spec> -s 192.168.0.30 --dst-range 192.168.0.10-20 -j REJECT --reject-with icmp-host-prohibited

<insert spec> depends on the existing rules. See the output of iptables -L and the iptables(8) man page for more details.

link|improve this answer
Thanks for the answer - but how could I avoid the host reaching the 10-20 hosts directly? Usually this is not transferred via the default route - so the firewall should not see these packages normally. Is there a easy solution or do I have to seperate the Network into VLAN's and bridge them on the firewall? – Florian Lagg May 18 '10 at 19:09
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.